T-0.5 Kyverno L0 policies + CLI tests + admission scaffolding (R-TEST-01, R-NET-01, R-SEC-01/02, R-IDP-02, R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/admission/kustomization.yaml

@@ -0,0 +1,18 @@
+# In-cluster enforcing bundle (SCAFFOLDING for T-2.7; not applied in Phase 0).
+# Installs Kyverno and applies the SAME policies authored for the CI L0 gate as an
+# admission controller -- authored once, shared between CLI and admission (ADR-0011).
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kyverno
+resources:
+  - namespace.yaml
+  - helmrelease.yaml
+  # --- policies SHARED verbatim with the CI L0 gate ---
+  - ../policies/require-default-deny-baseline.yaml
+  - ../policies/validate-default-deny-shape.yaml
+  - ../policies/restrict-host-namespaces.yaml
+  - ../policies/require-egress-class-label.yaml
+  - ../policies/require-auth-mode-label.yaml
+  # --- secrets: the admission variant REPLACES the CI-only sops-block policy ---
+  #     (../policies/disallow-plaintext-secrets.yaml is CI-only; see secret-provenance.yaml)
+  - secret-provenance.yaml